probably no need for AccessAssociation as separate public class
added some authorization messaging and logic